Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

A - Sources

Every figure used in the book, chapter by chapter, with its publisher, the date the data refers to, and the URL. “Checked” is the date the page was last read for this edition. Where a source is a vendor, a self-report or a synthetic benchmark, the entry says so, as the chapter did. Where a chapter cites a document I could not read directly, the entry says that too.

Charts are generated from the data files in charts/data/, each of which repeats its source, and the raw TechEmpower tables used by chapters 3 and 4 are stored as CSV in charts/raw/.

How to Read This Book

  • PHP release history and the features named: php.net release pages and changelogs, checked 17 September 2026. https://www.php.net/releases/
  • The PHP Foundation employing core developers since 2021: JetBrains announcement, 22 November 2021. https://blog.jetbrains.com/phpstorm/2021/11/the-php-foundation/

Footprint

  • Share of websites by server-side language (PHP 69.9 percent, JavaScript 7.5, Ruby 7.1, Java 5.4, Scala 5.0, ASP.NET 4.2, Python 1.1): W3Techs, data of 17 September 2026. https://w3techs.com/technologies/overview/programming_language
  • Historical share by year, values on 1 January (PHP 80.6 percent in 2015, 75.2 in 2025, 72.4 in 2026): W3Techs historical trends, checked 17 September 2026. https://w3techs.com/technologies/history_overview/programming_language/ms/y
  • JavaScript overtaking Ruby as second server-side language: W3Techs “technology fact of the day”, 27 July 2026. https://w3techs.com/
  • W3Techs methodology (sample of over 20 million sites, one site per domain, redirected domains excluded, daily updates): checked 17 September 2026. https://w3techs.com/technologies
  • WordPress 40.2 percent of all websites and 58.8 percent of CMS market; Joomla 1.1, Drupal 0.6, PrestaShop 0.5, TYPO3 0.3; 31.5 percent of sites without a detected CMS: W3Techs, 17 September 2026. https://w3techs.com/technologies/overview/content_management
  • WooCommerce 8.0 percent of all websites, 47.7 percent of e-commerce systems: W3Techs, 17 September 2026. https://w3techs.com/technologies/details/cm-woocommerce
  • Moodle 146,634 registered sites and 531 million users (self-registered sites only): stats.moodle.org, checked 17 September 2026. https://stats.moodle.org/
  • Nextcloud “500K+ servers”: Nextcloud, 2025 wrap-up, 11 December 2025. https://nextcloud.com/blog/nextcloud-2025-wrap-up/
  • Drupal 470,795 sites reporting their version: drupal.org usage statistics, week of 6 September 2026. https://www.drupal.org/project/usage/drupal
  • PrestaShop nearly 250,000 sites and more than 22 billion euros of sales in 2024 (self-reported): prestashop.com, checked 17 September 2026. https://prestashop.com/about-us/
  • Shopware on 115 of the 1,000 largest German B2C shops (EHI study 2025): Shopware, 10 January 2025. https://www.shopware.com/en/news/shopware-is-the-market-leader-among-ecommerce-platforms-in-germany/
  • Matomo “more than 1.4 million websites”: Matomo, 1 September 2026. https://matomo.org/blog/2026/09/matomo-launches-reseller-partner-programme/
  • Wikimedia 19.4 billion page views per month: Wikimedia Foundation audited financial statements, fiscal year 2023 to 2024. https://upload.wikimedia.org/wikipedia/foundation/f/f6/Wikimedia_Foundation_2024_Audited_Financial_Statements.pdf
  • Wikimedia production on PHP 8.3 since 25 November 2025: Phabricator T360995, resolved 18 December 2025. https://phabricator.wikimedia.org/T360995
  • Wikimedia migration to PHP 8.5 planned for late 2026: Phabricator T413223, created 19 December 2025. https://phabricator.wikimedia.org/T413223
  • Wikimedia end of HHVM in production: Phabricator T176370, resolved 23 November 2019. https://phabricator.wikimedia.org/T176370
  • Wikimedia 800,000 requests per second at the edge and seven data centres: Wikimedia Foundation, 26 November 2025. https://wikimediafoundation.org/news/2025/11/26/how-does-the-wikimedia-foundation-use-donations-to-wikipedia/
  • Automattic: Tumblr and WordPress “run on PHP primarily”: automattic.com, checked 17 September 2026. https://automattic.com/work-with-us/tumblr-migration/
  • WordPress VIP 2.4 trillion requests per year and 22 billion on election night 2024 (marketing page, CDN included): wpvip.com, checked 17 September 2026. https://wpvip.com/capabilities/performance/
  • Etsy engineers “primarily code in PHP and JavaScript”: careers.etsy.com, checked 17 September 2026. https://careers.etsy.com/engineering
  • Etsy on PHP 7 in 2016: talk “Deploying PHP 7”, PHP Conference Philippines, 13 October 2016. https://talks.php.net/ph16
  • Mailchimp PHP job runner and monolith: Mailchimp developer blog, “Computers are the easy part”, undated, checked 17 September 2026. https://mailchimp.com/developer/blog/computers-are-the-easy-part/ Job postings on jobs.intuit.com asking for PHP, 2025 to 2026, were read but expire and could not be archived; the chapter relies on the blog post.
  • Badoo three million lines of PHP, hundreds of servers, one million dollars saved: Bumble Tech, 7 February 2017. https://medium.com/bumble-tech/how-badoo-saved-one-million-dollars-switching-to-php7-fcbda94ad3ae
  • European Commission websites on Drupal: the generator metadata of commission.europa.eu declares Drupal 11, checked 17 September 2026. The figure of 770 live sites comes from a Commission staff presentation at Drupal4Gov EU, 29 January 2026, as reported by attendees; the slides were not found online and the figure is not confirmed by a Commission publication. https://drunomics.com/en/blog/drupal4gov-eu-2026-how-drupal-powers-european-governments-247
  • White House on WordPress VIP with FedRAMP Moderate authorisation: wpvip.com, March 2025. https://wpvip.com/blog/fedramp-moderate/
  • Germany’s Government Site Builder on TYPO3, more than 80 authorities and 250 sites: ITZBund and typo3.com, checked 17 September 2026. https://www.itzbund.de/DE/itloesungen/standardloesungen/gsb/gsb.html
  • GovCMS more than 370 sites for 115 agencies: govcms.gov.au, 2025, as cited by The PHP Foundation, 2 September 2026. https://thephp.foundation/blog/2026/09/02/digital-sovereignty-is-written-in-php/
  • LocalGov Drupal 77 council sites: localgovdrupal.org, checked 17 September 2026. https://localgovdrupal.org/
  • HHVM ending PHP support: hhvm.com, 12 September 2018 and 11 February 2019. https://hhvm.com/blog/2018/09/12/end-of-php-support-future-of-hack.html and https://hhvm.com/blog/2019/02/11/hhvm-4.0.0.html
  • Slack on Hack, about five million lines: Slack Engineering, 14 April 2020 and 8 February 2023. https://slack.engineering/hacklang-at-slack-a-better-php/ and https://slack.engineering/hakana-taking-hack-seriously/
  • Zalando rewrite in Java in 2010: account of a former Zalando engineer, 3 March 2020. https://srcco.de/posts/one-decade-in-zalando-tech.html
  • Trivago move from PHP to TypeScript: trivago tech blog, 16 May 2022. https://tech.trivago.com/post/2022-05-16-warp-a-web-application-rewrite-project
  • Dailymotion “gradually reducing PHP”, new development in Go, Java and Python: job posting “Senior Backend Software Engineer, Video Platform”, read 17 September 2026 (postings expire). https://jobs.smartrecruiters.com/Dailymotion/744000136260231-senior-backend-software-engineer-video-platform-full-remote-from-france- Historical use: Symfony blog, 18 February 2011.
  • BlaBlaCar migration “from a PHP/Symfony stack towards a Java/JS-dominated one”: job posting “Software Engineer, Backend”, read 17 September 2026 (postings expire). https://jobs.smartrecruiters.com/BlaBlaCar/743999670001836-software-engineer-backend Historical use: SymfonyCon Paris, 4 December 2015.
  • Developer survey figures (PHP 19.1 percent of professional developers, 12th): Stack Overflow Developer Survey 2025, fielded May to June 2025, 49,009 responses. https://survey.stackoverflow.co/2025/technology
  • JetBrains 17 percent used (13th language), 9 percent primary (9th), “long-term decline”: JetBrains State of Developer Ecosystem 2025, 24,534 respondents, fielded April to June 2025. https://devecosystem-2025.jetbrains.com/
  • 58 percent of PHP developers not planning to migrate: JetBrains, The State of PHP 2025, October 2025, 1,720 respondents. https://blog.jetbrains.com/phpstorm/2025/10/state-of-php-2025/
  • PHP sixth language by monthly contributors: GitHub Octoverse 2025, 28 October 2025. https://github.blog/news-insights/octoverse/octoverse-a-new-developer-joins-github-every-second-as-ai-leads-typescript-to-1/
  • PHP fourth, tied with C#: RedMonk language rankings, January 2026, published 14 April 2026. https://redmonk.com/sogrady/2026/04/14/language-rankings-1-26/
  • PHP 14th at 1.04 percent: TIOBE index, September 2026. https://www.tiobe.com/tiobe-index/

The Runtime

  • PHP-FPM process model and configuration: php.net manual, checked 17 September 2026. https://www.php.net/manual/en/install.fpm.php
  • OPcache: php.net manual, checked 17 September 2026. https://www.php.net/manual/en/book.opcache.php
  • Preloading figures (30 percent and 50 percent on two framework hello-world pages, “will likely be lower”): RFC Preloading, wiki.php.net, 2018, accepted 48 to 0. https://wiki.php.net/rfc/preload
  • JIT: “about 3 times better performance on synthetic benchmarks”, “typical application performance is on par with PHP 7.4”: php.net, PHP 8.0 release announcement. https://www.php.net/releases/8.0/en.php
  • JIT on WordPress, 326 against 315 requests per second: RFC JIT, wiki.php.net, 2019. https://wiki.php.net/rfc/jit
  • JIT disabled by default since PHP 8.4: php.net, OPcache configuration, opcache.jit. https://www.php.net/manual/en/opcache.configuration.php
  • FrankenPHP under the php organisation since 8 June 2025: The PHP Foundation, 15 May and 8 June 2025. https://thephp.foundation/blog/2025/05/15/frankenphp/ and https://thephp.foundation/blog/2025/06/08/php-30/
  • FrankenPHP worker mode, “not originally designed for long-running processes”, maximum requests setting: frankenphp.dev documentation, checked 17 September 2026. https://frankenphp.dev/docs/worker/
  • RoadRunner: roadrunner.dev, checked 17 September 2026. https://roadrunner.dev/
  • Swoole and OpenSwoole: openswoole.com and github.com/swoole/swoole-src, checked 17 September 2026.
  • FrankenPHP classic mode against PHP-FPM, 18,403 against 18,478 requests per second, p99 0.9 ms, eight-vCPU virtual machine: Tideways, 23 September 2025 (independent of both projects). https://tideways.com/profiler/blog/testing-if-franken-php-classic-mode-is-faster-and-more-scalable-than-php-fpm
  • Symfony under PHP-FPM, FrankenPHP and Swoole on the Fortunes test: TechEmpower Round 23, see the next section.
  • Bare process cost (2 MB heap, 33 MB resident, 20 ms): measured by the author on PHP 8.3.33 on Linux, 17 September 2026, with memory_get_usage(true) and /usr/bin/time -v. Reproducible with php -r ''.
  • Wikimedia container configuration (8 workers, 500 MB OPcache, 768 MB APCu, 1 to 2 GB per container): Phabricator T280497, 2021. https://phabricator.wikimedia.org/T280497

Throughput and Latency

  • “Execution time is often halved”: Zend (Rogue Wave), white paper “Maximize performance and mitigate risks with PHP 7”, 9 November 2017; a vendor document without published methodology. https://www.zend.com/sites/default/files/pdfs/rw-maximize-performance-mitigate-risks-wp-fnl-20171109.pdf
  • PHPBench scores for PHP 5.6.40 to 8.0-dev (288,326 to 876,420): OpenBenchmarking.org, result 2002269-VE-PHPBENCHM24 by Michael Larabel, February 2020, Core i9-9900KS, Ubuntu 20.04. https://openbenchmarking.org/result/2002269-VE-PHPBENCHM24
  • WordPress 146.09 requests per second on PHP 8.2 and 148.30 on PHP 8.5, “incremental releases rarely produce large speed jumps”: Kinsta, 13 December 2025; a hosting vendor’s benchmark, ApacheBench at 15 concurrent requests on a 30-vCPU machine, JIT off. https://kinsta.com/blog/php-benchmarks/
  • TechEmpower Round 23: results dated 24 February 2025, hardware described by TechEmpower as “ProLiant DL360 Gen10 Plus, Intel Xeon Gold 6330 (56 cores), 64 GB, 40 Gbps Ethernet”; the Xeon Gold 6330 has 28 cores and 56 threads. Results page (JavaScript-rendered), read with a headless browser on 17 September 2026, and stored as CSV in charts/raw/. https://www.techempower.com/benchmarks/#hw=ph&test=fortune&section=data-r23 Round announcement: https://www.techempower.com/blog/2025/03/17/framework-benchmarks-round-23/
  • TechEmpower repository archived: github.com/TechEmpower/FrameworkBenchmarks, archived, last push 24 March 2026, read through the GitHub API on 17 September 2026.
  • Wikimedia latency targets (50 ms median, 200 ms p99 for GET, 500 ms p99 for POST): Wikimedia, “Backend performance practices”, last edited 27 June 2026. https://wikitech.wikimedia.org/wiki/MediaWiki_Engineering/Guides/Backend_performance_practices
  • Wikimedia public latency dashboard: Grafana, “Backend Pageview Timing”; the median of about 170 milliseconds quoted in the chapter was read from it on 17 September 2026 around 10:25 UTC, over one hour, for requests reaching the application servers. https://grafana.wikimedia.org/d/QLtC93rMz/backend-pageview-timing
  • n-body elapsed times, fastest single-threaded entry per language (Rust 2.19 s, C# 3.13 s with native AOT, Java 6.02 s with native image, Go 6.39 s, Node.js 8.55 s, Ruby 166.67 s, PHP 204.10 s, Python 360 s), spectral-norm (PHP 18.29 s elapsed for 72.34 s CPU; Python 90.37 s; Ruby 56.52 s; Node.js 1.60 s): The Computer Language Benchmarks Game, checked 17 September 2026. https://benchmarksgame-team.pages.debian.net/benchmarksgame/performance/nbody.html and https://benchmarksgame-team.pages.debian.net/benchmarksgame/performance/spectralnorm.html
  • PHP command line used by the Benchmarks Game (PHP 8.4.1, opcache.jit_buffer_size=64M, no opcache.jit setting): program page for n-body PHP #3. https://benchmarksgame-team.pages.debian.net/benchmarksgame/program/nbody-php-3.html
  • JIT four-fold gain on Mandelbrot: RFC JIT, wiki.php.net, 2019. https://wiki.php.net/rfc/jit

Concurrency

  • Fibers: “all fibers exist within a single thread”, “blocking code … will continue to block the entire process”: RFC Fibers, wiki.php.net, accepted 50 to 14, March 2021. https://wiki.php.net/rfc/fibers
  • AMPHP, ReactPHP: amphp.org and reactphp.org, checked 17 September 2026.
  • TechEmpower Round 23 plaintext test figures: see the previous section; raw table in charts/raw/techempower-r23-plaintext.csv.
  • “Concurrency Support in the PHP Engine” RFC under discussion: wiki.php.net RFC index, checked 17 September 2026. https://wiki.php.net/rfc The earlier “PHP True Async” RFC shows status Canceled, last edited 22 July 2026. https://wiki.php.net/rfc/true_async

The Language in 2026

  • Every feature and its version: php.net release pages and the fact sheet in the polyglot book’s writing guide, both checked against php.net. Examples were run under PHP 8.5 with the official Docker image on 17 September 2026.

The Ecosystem

  • Packagist 468,099 packages, 5.8 million versions, 199.6 billion installs since 2012; monthly install series (2.0 billion in 2016 to 36.0 billion in 2025; 2.58 billion in August 2025 and 4.93 billion in August 2026): packagist.org/statistics, read 17 September 2026. https://packagist.org/statistics
  • composer audit introduced in Composer 2.4.0, 16 August 2022: getcomposer.org changelog. https://getcomposer.org/changelog/2.4.0 Documentation: https://getcomposer.org/doc/03-cli.md#audit
  • 1,649 advisories in the shared database: github.com/FriendsOfPHP/security-advisories, counted on 17 September 2026.
  • PIE 1.5, funded by the Sovereign Tech Agency: The PHP Foundation, quarterly report Q2 2026, 21 July 2026. https://thephp.foundation/blog/2026/07/21/quarterly-report-q2-2026/
  • Projects built on Symfony components (self-declared): symfony.com/projects, checked 17 September 2026. https://symfony.com/projects
  • Laravel 64 percent, WordPress 25 percent, Symfony 23 percent among PHP developers; PHPUnit 50, PHPStan 36, PHP-CS-Fixer 30, Pest 17, 32 percent writing no tests, 42 percent using no quality tool: JetBrains, The State of PHP 2025, October 2025. https://blog.jetbrains.com/phpstorm/2025/10/state-of-php-2025/
  • 14 accepted PSRs, PER Coding Style 3.1: php-fig.org, checked 17 September 2026. https://www.php-fig.org/psr/ and https://www.php-fig.org/per/coding-style/
  • Signed release tags since April 2012: php.net GPG keys page. https://www.php.net/gpg-keys.php

Governance and Longevity

  • RFC process and voting (two-thirds majority, two weeks of discussion, two weeks of voting, who votes): wiki.php.net, “How to create an RFC” and “Voting”. https://wiki.php.net/rfc/howto and https://wiki.php.net/rfc/voting
  • Declined RFCs: Nullable Intersection Types (12 to 26, August 2021) https://wiki.php.net/rfc/nullable_intersection_types ; Short Closures 2.0 (27 to 16, declined, July 2022) https://wiki.php.net/rfc/auto-capture-closure ; Asymmetric Visibility v1 (14 to 12, January 2023) https://wiki.php.net/rfc/asymmetric-visibility and v2 (24 to 7, August 2024) https://wiki.php.net/rfc/asymmetric-visibility-v2 ; Nested Classes (2 to 20, May 2025) https://wiki.php.net/rfc/short-and-inner-classes
  • RFC counts per version (31 for 8.4, 19 for 8.5, 29 for 8.6 as of September 2026): php.watch RFC index, a secondary source. https://php.watch/rfcs
  • Release dates of every version: php.net release archive and changelogs, checked 17 September 2026. https://www.php.net/releases/ and https://www.php.net/ChangeLog-8.php
  • Support policy and current windows: php.net, supported versions and end of life pages, checked 17 September 2026. https://www.php.net/supported-versions.php and https://www.php.net/eol.php
  • Release cycle update (security support extended, windows aligned to 31 December; votes 31 to 0 and 33 to 0): RFC, wiki.php.net, accepted April 2024. https://wiki.php.net/rfc/release_cycle_update
  • PHP 8.6 schedule (GA 19 November 2026, feature freeze 22 September 2026): wiki.php.net, PHP 8.6 release schedule. https://wiki.php.net/todo/php86
  • php-src activity (5,316 commits and 171 authors on master in the twelve months to 17 September 2026; 1,644 contributors): measured on a clone of github.com/php/php-src with git log, and the GitHub contributors API, 17 September 2026.
  • The PHP Foundation founding (22 November 2021, ten founding members, the departure that triggered it): JetBrains, 22 November 2021, and thephp.foundation. https://blog.jetbrains.com/phpstorm/2021/11/the-php-foundation/ and https://thephp.foundation/
  • Transparency reports: 2022 (22 November 2022) https://thephp.foundation/blog/2022/11/22/transparency-and-impact-report-2022/ ; 2023 (26 February 2024) https://thephp.foundation/blog/2024/02/26/transparency-and-impact-report-2023/ ; 2024 (31 March 2025) https://thephp.foundation/blog/2025/03/31/transparency-and-impact-report-2024/ ; 2025 (27 May 2026) https://thephp.foundation/blog/2026/05/27/impact-and-transparency-report-2025/
  • Structure (thirteen engineers, executive director, board of ten): thephp.foundation/structure, checked 17 September 2026. https://thephp.foundation/structure/
  • All-time contributions by sponsor (Automattic 762,500 dollars, JetBrains 476,670, total 3,368,941): opencollective.com/phpfoundation, read 17 September 2026. https://opencollective.com/phpfoundation
  • Sovereign Tech Agency grants (205,000 euros in 2023; 223,680 euros in 2025): sovereign.tech. https://www.sovereign.tech/tech/php and https://www.sovereign.tech/tech/php-2025
  • Alpha-Omega grant and the Ecosystem Security Team: The PHP Foundation, 18 May 2026. https://thephp.foundation/blog/2026/05/18/announcing-ecosystem-security-team/
  • Security policy and classification: github.com/php/php-src security policy and github.com/php/policies. https://github.com/php/php-src/security/policy and https://github.com/php/policies/blob/main/security-classification.rst
  • External audit results (27 issues, 17 with security implications, 3 high): The PHP Foundation, 10 April 2025. https://thephp.foundation/blog/2025/04/10/php-core-security-audit-results/
  • CVE counts by publication year (8, 7, 18, 13, 14): NVD API, product cpe:2.3:a:php:php, queried 17 September 2026. https://nvd.nist.gov/ GitHub advisories for php-src: https://github.com/php/php-src/security/advisories

Cost of Ownership

  • Stack Overflow 2025 usage (JavaScript 68.8 percent, Python 54.8, TypeScript 48.8, C# 29.9, Java 29.6, PHP 19.1, Go 17.4, Rust 14.5, Ruby 6.9 among professional developers) and “admired” figures (Rust 72.4, TypeScript 58.0, Go 56.5, Python 56.4, C# 55.8, JavaScript 46.8, Ruby 44.3, Java 41.8, PHP 38.9): Stack Overflow Developer Survey 2025. https://survey.stackoverflow.co/2025/technology
  • Median salary by language (PHP 49,586 dollars, second lowest of fifty): Stack Overflow Developer Survey 2024, “Top paying technologies”. https://survey.stackoverflow.co/2024/technology#top-paying-technologies
  • 613 permanent UK job advertisements citing PHP in the six months to 17 September 2026, 404 a year earlier, median 48,676 pounds: IT Jobs Watch, a UK aggregator, secondary. https://www.itjobswatch.co.uk/jobs/uk/php.do
  • Badoo one million dollars saved: Bumble Tech, 7 February 2017, as in Footprint.
  • Wikimedia upgrade cadence: PHP 7.4 to 8.1 announced on wikitech-l on 17 March 2025 and completed that month; 8.1 to 8.3 completed 25 November 2025 (Phabricator T360995); 8.5 planned for late 2026 (Phabricator T413223).
  • PHP versions by population: Packagist php-statistics, August 2026 https://packagist.org/php-statistics ; wordpress.org statistics API, read 17 September 2026 https://api.wordpress.org/stats/php/1.0/ ; W3Techs PHP versions, 17 September 2026 https://w3techs.com/technologies/details/pl-php
  • End of security support for PHP 7.4 (28 November 2022) and PHP 5.6 (31 December 2018): php.net end of life page. https://www.php.net/eol.php

Where PHP Is the Wrong Choice

  • All figures are repeated from the chapters above and carry the same sources.

Not used, and why

Figures that circulate about PHP and that I left out because no primary source could be found, or because the primary source contradicts them:

  • “Spotify serves 600,000 requests per second with Symfony”: a global traffic figure repeated by agency blogs; the only primary source is a 2015 talk about the spotify.com website.
  • “Etsy moved from HHVM back to PHP 7 in 2019 or 2020”: Etsy was on PHP 7 in 2016; HHVM was only ever used on its API cluster.
  • “Laravel is used by OpenAI, Apple, Nike, NASA”: a claim on laravel.com without a source per company.
  • “Adobe Commerce processed 6.2 billion dollars on Black Friday 2024”: found only on third-party aggregators; Adobe’s own releases give figures for all United States e-commerce measured by Adobe Analytics.
  • “Mercedes-Benz sponsors The PHP Foundation”: not on the foundation’s sponsor list.
  • “PHP 8 is three times faster than PHP 7”: the figure is for synthetic benchmarks and comes from the JIT RFC; the same page says typical applications are on par with PHP 7.4.
  • Vimeo’s “one million lines of PHP” (December 2020): the article is no longer online; Psalm’s origin at Vimeo is the only claim I keep.
  • Any figure on the number of PHP developers worldwide: the last primary figure found is 7.3 million in the third quarter of 2021 (SlashData), and nothing more recent could be traced to a primary page.